For the Carlini&Wagner (C&W) method [1]} has three versions, an \(L_2\) , an \(L_0\)  and an \(L_\infty \)  attack. We will employ the most commonly used \(L_2\)  attack.
For a given image \(X\)  this method generates an adversarial example \(X^{adv}\)  by solving the following optimization problem:
\(\text{min}||\frac{1}{2}(\tanh (X^{adv})+1)-X||_2^2+c\cdot f(\frac{1}{2}(\tanh (X^{adv})+1)).\) 
